15 min read
Axios npm compromise: XOR dropper to cross-platform RAT
Axios 1.14.1 supply chain attack torn apart. XOR dropper deobfuscated, macOS Mach-O decompiled, Windows PowerShell RAT reversed, C2 protocol mapped.
npm Tracker
Anyone can publish to npm, and a package your build already trusts can turn hostile in a single release. Most of it is the same handful of tricks: run on install, read the environment, post it somewhere. Thanks to Artifactly for the feed, and to Permiso, we appreciate you.
Updated 03:01 UTC
Packages flagged per day
Latest 9 investigated
| Package | Version | Verdict | Published |
|---|---|---|---|
file-type-detector investigation, opens in a new tab | 1.1.1 | Confirmed | Sep 10, 2026 22:33 UTC |
open-item-validator investigation, opens in a new tab | 1.0.5 | Confirmed | Sep 10, 2026 22:18 UTC |
open-item-validator investigation, opens in a new tab | 1.0.3 | Confirmed | Sep 10, 2026 22:17 UTC |
gloggo investigation, opens in a new tab | 1.1.2 | Confirmed | Sep 10, 2026 22:15 UTC |
gloggo investigation, opens in a new tab | 1.1.4 | Confirmed | Sep 10, 2026 22:02 UTC |
file-type-detector investigation, opens in a new tab | 1.1.0 | Confirmed | Sep 10, 2026 21:47 UTC |
toru-ultimate investigation, opens in a new tab | 1.0.0 | Confirmed | Sep 10, 2026 21:43 UTC |
bx-ui-view investigation, opens in a new tab | 1.0.0 | Confirmed | Sep 10, 2026 21:28 UTC |
@yongot/canary-mcp-isolation investigation, opens in a new tab | 1.0.1 | Confirmed | Sep 10, 2026 21:27 UTC |
